mz-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent on how to use the mz-deploy CLI to manage the deployment lifecycle of SQL projects. Evidence includes documented commands for staging, promoting, and applying SQL changes to Materialize environments.
  • [CREDENTIALS_UNSAFE]: The skill describes managing database connection profiles via profiles.toml and ~/.mz. It follows security best practices by recommending environment variable substitution for password management instead of hardcoding secrets.
  • [EXTERNAL_DOWNLOADS]: Installation instructions point to the official vendor repository for the CLI tool. The command brew install materializeinc/materialize/mz-deploy targets a trusted source.
  • [PRIVILEGE_ESCALATION]: The skill documents that the mz-deploy setup command requires superuser privileges during initial configuration to establish necessary database roles and grant system privileges when Role-Based Access Control (RBAC) is enabled.
  • [DYNAMIC_EXECUTION]: The test and explain commands utilize Docker to run SQL validation and unit tests within an isolated container environment named mz-deploy-sandbox.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 05:55 AM
Security Audit — agent-trust-hub — mz-deploy